CVE-2015-7309
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files,...
CVE-2015-7309 is a medium vulnerability (CVSS 6.5) in Boltcms Bolt, published September 22, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.6%, the 98th percentile. No source names a fixed version.
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Exploit likelihood
What each source reports
NVD Score used
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
- Record
CVE-2015-7309- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
- Record
CVE-2015-7309- Updated
- 2026-11-02
EUVDEUVD-2015-7238 No score
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
- Record
EUVD-2015-7238- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfg2-33mf-746p No score
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files,...
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
- Record
GHSA-gfg2-33mf-746p- Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | CMS Bolt - Arbitrary File Upload (Metasploit) | 2015-09-15 |
| Metasploit | CMS Bolt File Upload Vulnerability | 2015-08-17 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
References
packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.html
seclists.org/fulldisclosure/2015/Aug/66
exploit-db.com/exploits/38196
blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html
bolt.cm/newsitem/bolt-2-2-5-released
rapid7.com/db/modules/exploit/multi/http/bolt_file_upload
nvd.nist.gov/vuln/detail/CVE-2015-7309
github.com/advisories/GHSA-gfg2-33mf-746p